Security Software Enumeration via Get-MpComputerStatus, sc query, tasklist, wmic product

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where a process executes multiple system enumeration commands (Defender status, service query, product enumeration, or process listing) within a short window, often associated with reconnaissance activity.